IOS MDM Service and MDM Agent Application

Question

I am learning MDM in iOS and find out information about the iOS mobile device for Apple mobile devices. After the device is registered on the MDM server, the server can control the device by sending commands. I tested on the MDM server and saw that without installing the MDM agent application on the device, the server can still send profiles and apply policies to the device.

Can someone help me contact:

• Is the Apple iOS mobile app embedded in iOS?
• Can the MDM server manage the device (install applications, disconnect the camera, iTunes ...) without installing the MDM agent application?
• How can the device itself communicate with the MDM server and automatically install profiles sent from the server?
• Do I need an enterprise account to use the MDM iOS service?
• Where can I find documents about the MDM API and how to use it?

Answer 1

Is the core iOS mobile app built into iOS?

Yes - on iOS4 devices become MDM-compatible.

Can the MDM server manage the device (install applications, disconnect the camera, iTunes ...) without installing the MDM agent application?

Yes. The only thing that the MDM agent application will receive is the ability to report on the IP address / network information of the device, user logging, etc. By default, iOS does not allow you to track user network data.

How can the device itself communicate with the MDM server and automatically install profiles sent from the server?

This is what I call the "circle of hell." Your MDM sends commands / installation packages to the APN server, the APN server informs the device that it has a pending command from MDM, the device contacts MDM for its instructions and confirms. My alias is a problem related to setting firewall access permissions in large enterprises.

Do I need an enterprise account to use iOS MDM service delivery? Where can I find documents about the MDM API and how to use it?

To use the MDM service, which does not require an Enterprise account. To create an MDM service and access its documentation, you need to have a corporate account of $ 299 per year.

Answer 2

• Yes.
• N / A, since the "agent" is already created in iOS
• To control the device using MDM, the device must first be registered manually. During the registration process, the configuration file will be installed on the device containing the MDM server information. The MDM frame also uses push notification to communicate with the device.
• Yes. In addition, you also need the ability to generate an MDM provider certificate on the Apple Developer Portal.

Answer 3

Is native iOS mobile device management built into iOS itself?

Yes, Apple has a secure mdm client that is included with every Apple product. We can use the client during registration. There is controlled registration where the mdm client can perform more privileged tasks.

Can the MDM server manage the device (install applications, disconnect the camera, iTunes ...) without installing the MDM agent application?

Yes, after registering the device, you can apply restrictions for iOS and macOS, install applications in silent mode using VPP, etc. See Configuration-Profile-Reference.pdf for a list of all restrictions.

How can the device itself communicate with the MDM server and automatically install profiles sent from the server?

Like iOS apps, the mdm client responds to notifications via APNS. The server on which the device is registered will have a push-magic string, a device token, and a thematic device listening on them helps the server notify the device. The device will ping the server. I have attached the Official MDM Guide, which you can contact for more information.

Do I need a corporate account to use iOS MDM?

Here you have two options, if you want to create your own MDM solution, as I said, you will need to notify the device so that it communicates with your MDM server during registration. Like creating an iOS app, you need a developer account to create an APNS certificate (see here ) to notify the default mdm client.

Or you just want to manage your device, you do not need a developer certificate. MDM providers will use their certificate for signing, and you will need an Apple ID account to use the boot certificate provided by your MDM to notify devices.

Where can I find documents about the MDM API and how to use it?

Below are the links to get started with MDM. Comment on your requests for any help.

1. Configure MDM and MDM protocol

2. Limitations and other MDM profiles

3. Apple business manager